General
-
Target
74a990f0aa6fb54bd8f911544b04fc8177bae8ac2e6ace909811bb83a5c0a619
-
Size
230KB
-
Sample
221002-2nynksdhb8
-
MD5
6ee5ac3f9753befecf2409c098b64560
-
SHA1
db6c11c00af1a07563ecda46f76e2d9b24e798f4
-
SHA256
74a990f0aa6fb54bd8f911544b04fc8177bae8ac2e6ace909811bb83a5c0a619
-
SHA512
c5e5dd973e571fd283f20e4b27d7ed2f96b1e77d461c7197f3e229b57614c0ddf82a82b7de6753b12c1e5287adaaccebb679cc8a8f4efd431c1a80efb9bc734f
-
SSDEEP
6144:Xh/K66aoIGDOF9EAH7dwpODbMCvuwUepFqDg:Xh/K6QIGDOF9EAHDblFWDg
Static task
static1
Behavioral task
behavioral1
Sample
74a990f0aa6fb54bd8f911544b04fc8177bae8ac2e6ace909811bb83a5c0a619.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
74a990f0aa6fb54bd8f911544b04fc8177bae8ac2e6ace909811bb83a5c0a619.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
njrat
0.7d
تم دخول ضحية
memo2016com.ddns.net:9900
6c96d32f21f3e8fd06f949dd6e00f855
-
reg_key
6c96d32f21f3e8fd06f949dd6e00f855
-
splitter
|'|'|
Targets
-
-
Target
74a990f0aa6fb54bd8f911544b04fc8177bae8ac2e6ace909811bb83a5c0a619
-
Size
230KB
-
MD5
6ee5ac3f9753befecf2409c098b64560
-
SHA1
db6c11c00af1a07563ecda46f76e2d9b24e798f4
-
SHA256
74a990f0aa6fb54bd8f911544b04fc8177bae8ac2e6ace909811bb83a5c0a619
-
SHA512
c5e5dd973e571fd283f20e4b27d7ed2f96b1e77d461c7197f3e229b57614c0ddf82a82b7de6753b12c1e5287adaaccebb679cc8a8f4efd431c1a80efb9bc734f
-
SSDEEP
6144:Xh/K66aoIGDOF9EAH7dwpODbMCvuwUepFqDg:Xh/K6QIGDOF9EAHDblFWDg
Score10/10-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-